MD-100 100: Modern Device Management 5 — Questions and Answers
Question 1: A Windows 10 device managed by Intune needs to have a specific registry key set that is not available in standard Intune profiles. What is the BEST approach?
- Manually configure each device via Remote Desktop
- Deploy a PowerShell script through Intune
- Use a Group Policy Object linked to the OU
- Create a custom OMA-URI configuration profile (Correct answer)
Correct answer: Create a custom OMA-URI configuration profile
Custom OMA-URI profiles in Intune allow administrators to configure settings using Windows MDM CSP paths, enabling registry-level configurations not exposed in the GUI.
Question 2: Which Windows Autopilot deployment mode is used to pre-configure a device for a specific user before the user receives it?
- Self-Deploying Mode
- User-Driven Mode
- Pre-provisioning (White Glove) Mode (Correct answer)
- Reset Mode
Correct answer: Pre-provisioning (White Glove) Mode
Pre-provisioning (White Glove) mode allows technicians or partners to complete the device setup phase so users only need to complete the user-specific portion of OOBE.
Question 3: An administrator notices that a Windows 10 device's Intune policies are not applying. Which command forces an immediate Intune policy sync on the device?
- gpupdate /force
- Start-Process 'ms-settings:workplace'
- Invoke-Command -ScriptBlock {Sync-MDMPolicy}
- From Company Portal: click 'Sync' or use Settings > Accounts > Access work or school > Sync (Correct answer)
Correct answer: From Company Portal: click 'Sync' or use Settings > Accounts > Access work or school > Sync
Users or admins can force an Intune policy sync by clicking Sync in the Company Portal app or navigating to Settings > Accounts > Access work or school and selecting the account then Sync.
Question 4: Which Windows 10 feature uses machine learning to detect and block zero-day threats at the endpoint level?
- Windows Defender Antivirus cloud-delivered protection (Correct answer)
- Windows Defender Firewall with Advanced Security
- Windows Defender Credential Guard
- Windows Defender Device Guard
Correct answer: Windows Defender Antivirus cloud-delivered protection
Cloud-delivered protection in Windows Defender Antivirus uses Microsoft's cloud intelligence and machine learning to detect emerging and zero-day threats in near real-time.
Question 5: A company requires that Windows 10 devices automatically encrypt drives when the device is enrolled in Intune. Which Intune setting enables silent BitLocker encryption?
- Require BitLocker in the Device Compliance Policy
- Configure BitLocker with 'Hide prompt about third-party encryption' enabled in Endpoint Protection profile (Correct answer)
- Enable BitLocker via a PowerShell script only
- Set the BitLocker enforcement level in Windows Hello for Business policy
Correct answer: Configure BitLocker with 'Hide prompt about third-party encryption' enabled in Endpoint Protection profile
Silent BitLocker encryption is achieved by configuring Endpoint Protection profile with the option to hide third-party encryption prompts and enabling auto-encryption for compliant devices.
Question 6: Which Windows 10 diagnostic data level is the MINIMUM required for Microsoft to provide Windows Update for Business recommendations?
- Security (off)
- Basic (Required) (Correct answer)
- Enhanced (Optional)
- Full (Optional)
Correct answer: Basic (Required)
At minimum, the Basic (Required) diagnostic data level must be enabled for Windows Update for Business and Update Compliance features to function.
Question 7: An administrator wants to verify that a Windows 10 device enrolled in Intune has successfully applied all assigned configuration profiles. Where in the Azure portal should they look?
- Azure AD > Devices > Device settings
- Intune > Devices > [Device name] > Device configuration (Correct answer)
- Azure AD > Enterprise Applications > Device compliance
- Intune > Apps > App protection policies
Correct answer: Intune > Devices > [Device name] > Device configuration
In Microsoft Intune admin center, navigating to Devices > [specific device] > Device configuration shows the assignment and application status of all configuration profiles for that device.
MD-100 100: Modern Device Management 5
A Windows 10 device managed by Intune needs to have a specific registry key set that is not available in standard Intune profiles.
What is the BEST approach?